Jailbreaking legalized in terms of Y^HDMCA

Apparently the EFF was able to relax some conditions of the DMCA.
Thanks to them it is now legal to jailbreak your phone.
Thats great news! :) Of course that only expresses what
sounds like human digital rights anyway: to own what you own.
As a nice coincidence I was meeting some of them two weeks ago
at a developers conference.


Small side-notice: 743C is still accepting device-donations.
If you have an android >= 2.0 device (preferably newer ones
like DroidX, Milestone, Backflip, Hero, Desire etc.)
that you dont need anymore
please leave me a comment with your contact address.
I dont need the GSM part (e.g. no SIM). I run most of
the stuff inside emulator, but certain things need
a real device as seen with /etc/firmware
or the additional software that is installed by the
vendor/carrier.
It would help to develop jailbreaks in future.


Some people uploaded videos of jailbreaks, using 734C
exploits like this or that.

exploid works on the Droid X

It has been reported that apperently someone was
able to compile and run the exploid on the oh
so unbreakable Droid X.
There seem to be devices with missing /etc/firmware which
is needed as an exploit vector. However there are other
possibilities to exploit this init-bug. But its not the
scope of 743C to provide working versions for every device.
Please note that this is a non-commercial spare-time project
and I even do not own any device for testing.


If the firmware subsystem doesnt work (it requires /etc/firmware
so an additional path traversal bug can be exploited too),
one may also try the usb, graphics, block, char, sound or mtd
subsystem to create mode 0666 devices or to exploit
a race condition during the device-creat
to chown /dev/mtd. It should be
possible, however I dont have time to do so :)

android trickery

Free your phone.

Fixing large file truncation in lophttpd

I dont want this to become a webserver blog, but I just fixed
a bug which lead to truncation of  large files (e.g. >1Gig)
while downloading. Stupid bug by using %d rather than %zu.
Its available at the usual location (version 0.85). 

Thanks to the one and only Nico for reporting. Your mad
scientists can now continue to download the star collision avi's.

New lophttpd version supports faster logging

As announced in my previous post; the new lophttpd
package supports mmap and aio based logging now,
if enabled via -L mmap or -L aio .

Looking for lophttpd testbeds

I am looking for heavy loaded sites which serve static
content (e.g. banners, pictures,  iso's etc.) to test
my http server software and to help it to improve.
I added  some experimental features recently
which will be released soon and mainly consit of
various log providers to overcome possible bottlenecks
during logging.
If you have  thousands requests/sec, writing out logs 
can become an issue and I added support for AIO and
mmaped-backed buffers.

If you are interested, drop me an email or a comment.I am
BTW also looking for donations of mobile devices
to continue my Android and WebOS research. :)

New lophttpd packges fixes some issues

I just published version 0.81 of lophttpd
to fix potential access of not mapped memory areas
if large directories are autoindexed. Some other things
has been fixed too (see Changelog).


Thanks to Alexander Hagenah for reporting the autoindex
issue.If you experiance any bugs or performance drops
or alike, please let me know.
 

CONFIG_UNIX_MONITOR=y

I digged into the depth of network packet handling, softirq's
and packet queues and hacked down a patch for the
2.6.34 kernel so that PF_PACKET can be applied to
PF_UNIX sockets.
The goal is to have a unix interface one day which you
can pass to pcap_create() and  wireshark or tcpdump.
With a e.g. DBUS dissector you can then monitor 
the application level IPC to find the more unknown
bugs :-)
The hard part now is to get this patch upstream,
so that it is available on a standard Linux distro
the same way you'd monitor your network traffic.

Small fix for lophttpd

I uploaded a new version of lophttpd since it was
not properly decoding URL escapes (%2B etc). Not
a security issue, but it was just ignoring escapes
completely %-D
Since the download stats for lophttpd are quite
impressive, I quickly added it. I already found the first
lophttpd banners in the wild. :)

The amount of download is of course not as impressive
as for devshit. I think most people don't realize that
this is not an exploit that pops you up a rootshell.Instead
it sets up a portable HDD which, upon plugin into a vulnerable
DeviceKit installation, creates a rootshell on the system.
IOW you need console access.

CVE-2010-0436 PoC

The fixes for the CVE-2010-0436 have been released last week,
so comes the PoC. I wonder nobody has already done it yet,
as its an easier one. Its a classic symlink attack in KDM
with an additional "trick" that requires to keep the
directory where the vulnerability happens has to be/made
owned by the user in order to work.
The vulnerabilities in-depth description is here.